ThreatFox IOC Database
You are viewing the ThreatFox database entry for url https://api.telegram.org/bot2011911710:AAFbAKM_5V9w0QGHqXxcRu9A7iFSTWlskIg/sendMessage?chat_id=1293496579.
Database Entry
This IOC expired
This IOC is an old IOC and hence has expired on 2026-09-15 10:39:25 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 238667 |
|---|---|
| IOC: | https://api.telegram.org/bot2011911710:AAFbAKM_5V9w0QGHqXxcRu9A7iFSTWlskIg/sendMessage?chat_id=1293496579 |
| IOC Type : | url |
| Threat Type : | botnet_cc |
| Malware: | 404 Keylogger |
| Malware alias: | 404KeyLogger, Snake Keylogger |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| ASN: | AS62041 Telegram |
| Country: |  VG |
| First seen: | 2021-10-27 19:55:08 UTC |
| Last seen: | never |
| UUID: | c9bb4c9b-375f-11ec-8ab6-42010aa4000a |
| Reporter |  AndreGironda |
| Reward | 5 credits from ThreatFox |
| Tags: | SnakeKeylogger |
| Reference: | https://tria.ge/211027-taflvafec5 |
AndreGironda
MITRE T1566.001Date: Sun, 24 Oct 2021 22:00-22:30 -0700
Received: from [147.135.165.30] (bizcloud-smcru.com [IPv6:::1])
Content-Type: multipart/mixed; boundary="===============1012671442=="
MIME-Version: 1.0
Subject: Teklif Talebi
To: Hasan.Dastan@Birler.com.tr
From: "Hasan Dastan" <Hasan.Dastan@Birler.com.tr>
Message-Id: <20211025051659.BDDA36B686@bizcloud-smcru.com>
Return-Path: Hasan.Dastan@Birler.com.tr
Attachment Name: BOQ Drawings.pdf.7z
Attachment SHA256: 8283821fc5e59a90e5d45882478a08fa86d98ef7cf1f2055c84ffffb62dc65ff
Unzipped Executable Name: BOQ Drawings.pdf.exe
Executable SHA256: 6852eb3651d23650c65945cea17d1a43d82f1035354a2a9832c8e7f70950ffc8
Stage 1 URL: hXXps://cdn.discordapp[.]com/attachments/902016899695657064/902017185529069568/tsclifetimesnake.exe
Stage 2 URL: hXXps://cdn.discordapp[.]com/attachments/898085606138212365/898088211937656832/Form1.dll